The present invention relates to an engine throttle control system, for instance for use in controlling an internal combustion engine for driving a vehicle.
Throttle control systems for controlling petrol and diesel engines for vehicles include the so-called "drive by wire" system in which there is no mechanical linkage between a driver actuated accelerator pedal or cruise control command switch and a mixture controlling system, such as one or more carburettors or a fuel injection system. Systems of this type also lend themselves readily to automatic traction control functions for preventing wheel spin during heavy acceleration and/or in conditions of poor ground adhesion. However, special requirements are placed on the performance and safety of such systems, which must function reliably and in accordance with various design parameters at all times.
Drive by wire systems are governed by various regulations which, among other things, specify how such systems should perform in the event of a component failure. Thus, U.S. Federal Law requires that there shall be at least two sources of energy capable of returning a throttle to its idle position within a specified time limit from any accelerator position or speed whenever a driver removes the opposing actuating force. Further, in the event of a failure of one source of energy, the throttle is required to return to the idle position within the specified time limit. Other conditions and situations may require a different "fail safe" or "fail soft" action, for instance merely warning the driver of a failure in one of the system channels but allowing at least limited drivability so that a vehicle does not become stranded but can be driven to a garage for repair.
Servo control systems for engine throttles have been devised to provide a desirable accelerator pedal sensation with good isolation from engine vibration and to facilitate trimming of the response of the engine to the accelerator pedal. Such systems allow additional features to be incorporated, such as vehicle speed control and traction control, since throttle positioning in all modes of operation can be controlled by a single actuator and position controller. Vehicle acceleration disturbances and mechanical complexity associated with, for instance, changeover from accelerator pedal command to cruise control can be minimised.
If a system of this type were to fail such that a throttle was driven open against the wishes of a driver, an accident might be caused. A known system for providing fail safe operation uses a brushed motor driving a throttle against a return spring through a reduction gear box. This system is fitted to a car which has two separate inlet manifolds, each with its own throttle, servo system, and fuel and ignition control. If a control system failure is detected, then the fuelling and ignition can be disabled on the associated manifold and the driver can be warned. The vehicle can then proceed at reduced power.
A mechanism of this type with a brushed motor and a reduction gear box requires a return spring which is capable of closing the throttle against a short circuited motor within a specified time limit. The motor itself provides a second source of energy for closing the throttle to the idle position. However, there can be problems with the reliability of this type of mechanism for use in an engine with a single inlet manifold, because a relatively small piece of foreign matter, such as a fragment of a motor brush, could jam the motor or gear box. This would prevent closure by the relatively low powered motor or return spring, which latter would have to work through a disadvantageous gear ratio. Accordingly, direct drive mechanisms have been devised using brushless torque motors sufficiently powerful to open the throttle against friction forces and the return spring without any gearing.
Although coincident failures arising from independent causes are unlikely, it is possible, in a system having two sources for returing the throttle to the idle position, for a failure in one to lie dormant and undiscovered for a long period, possibly until a failure occurs in the other system. Thus, if both systems failed in this way, it could become impossible to close the throttle and there would be serious risk of an accident or mechanical damage, for instance caused by over-revving of the engine.
In such systems, it is possible for a servo control loop to become unstable, for instance because a mismatch arises between the element being controlled and parameters of an associated controller. It is also possible that faults in command signals or elsewhere, or the ingress of foreign matter, could lead to the throttle actuator being driven hard against an end stop for its movement, or against an obstruction. Again, this could produce driving behaviour of the vehicle likely to cause an accident or mechanical damage to the vehicle.
In such systems, the angular position of the throttle is normally derived from measurement of the accelerator pedal position. It is possible to provide two return springs acting on the accelerator pedal so as to urge it towards the idle position. The accelerator pedal is actuated by the foot of a driver against these spring forces, and it is possible that a driver would not notice if one spring were to weaken or break or become disconnected. The failure might only become apparent when the other spring failed, again leading to loss of control of the engine throttle. It is further possible that a failure may occur giving rise to the accelerator pedal position detector sending a signal to a control unit representing a pedal depression in excess of that demanded by the driver, but less than a maximum legitimate pedal depression.
In such systems where the throttle motor provides one source for closing the throttle and normally acts against the bias of a return spring tending to return the throttle to the idle position, the throttle closing action of the motor may not be regularly tested in the absence of a failure, since this function is performed by the return spring. Thus, a failure in the part of the system responsible for causing the motor to close the throttle may lie dormant and only become apparent should the return spring fail. If the components responsible for causing the motor to close the throttle were to be energised during normal engine operation with a normally operating return spring, the throttle would close very quickly and this might stop the engine, cause a noticeable disturbance to the control of the vehicle, or cause damage immediately or over a period of time.